Exam XSIAM-Engineer Topic 2 Question 31 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 31
Topic #: 2
A complex Cortex XSIAM playbook orchestrates multiple actions, including endpoint isolation via Cortex XDR, user disablement via an Azure AD integration, and ticketing via ServiceNow An incident triggers this playbook, but it consistently gets stuck in a 'Pending' state at the 'Disable User in Azure AD' task. The Azure AD integration status in XSIAM is 'Connected'. Reviewing the XSIAM internal task queues (via API/CLI if available) shows a growing backlog of 'Azure AD' related tasks. No explicit error message is immediately visible in the playbook run details, only the 'Pending' status. What are the two most likely causes for this specific bottleneck and how would you investigate them?

Suggested Answer: A,D Vote an answer

A 'Pending' state with a growing backlog for a specific integration's tasks (Azure AD) strongly points to an issue with that integration's ability to process requests, not a general XSIAM engine limit. Hitting an external API rate limit (A) is a very common cause for queued requests to external services, as the remote API will simply stop responding or respond with a 429 status code. The XSIAM integration would then queue the requests while waiting for the rate limit to reset. Another highly probable cause is a misconfigured retry mechanism (D). If a task initially fails (e.g., due to a transient issue or even a permission error that isn't immediately surfaced as a hard failure), and the retry logic is too aggressive or doesn't back off correctly, it can exhaust the integration's available worker processes, leading to a permanent 'Pending' state for all subsequent tasks. Option B is unlikely because the issue is specific to Azure AD tasks. Option C (network latency) would typically result in timeouts with errors , not just indefinite 'Pending' states, unless the timeouts are extremely long. Option E (permission issues) would usually result in an immediate 403 Forbidden error from Azure AD, which should be reflected in the playbook logs, not just a 'Pending' state, unless the integration is designed to retry indefinitely on such errors.

by Susie at Feb 25, 2026, 01:43 AM

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

0
0
0
10